Hacker News Reader

This specific token is time-based, so a clone would not be detected.

On the other hand, counter-based tokens as you described them do exist, and it would indeed be simple to detect if one of those was cloned.

I wouldn't even call this an attack, given that you would need physical access to a rooted device to carry it out.

View on HN

Ah, time-based tokens are basically against adversaries with physical access to your time-based token. Good against password guessers / leaked password databases, however, which is a much more realistic attack these days.

OTP tokens usually don't protect you against server database compromise because they're completely symmetric. The server has a copy of the seed/key stored in the clear. OTPs really only protect you against key logging

I mean for the password reuse case. You use the same password for example.com and Gmail. Someone steals the example.com password database. They still can't log into your Gmail account because they don't have your second factor.

Reply on news.ycombinator.com